diff --git a/keyserver/src/fetchers/thread-permission-fetchers.js b/keyserver/src/fetchers/thread-permission-fetchers.js
--- a/keyserver/src/fetchers/thread-permission-fetchers.js
+++ b/keyserver/src/fetchers/thread-permission-fetchers.js
@@ -200,7 +200,6 @@
 
 type CandidateMembers = {
   +[key: string]: ?$ReadOnlyArray<string>,
-  ...
 };
 type ValidateCandidateMembersParams = {
   +threadType: ThreadType,
@@ -337,19 +336,20 @@
     return candidates;
   }
 
-  const result = {};
+  const result: { [string]: ?$ReadOnlyArray<string> } = {};
   for (const key in candidates) {
     const candidateGroup = candidates[key];
     if (!candidateGroup) {
-      result[key] = candidates[key];
+      result[key] = candidateGroup;
       continue;
     }
-    result[key] = [];
+    const resultForKey = [];
     for (const candidate of candidateGroup) {
       if (!ignoreMembers.has(candidate)) {
-        result[key].push(candidate);
+        resultForKey.push(candidate);
       }
     }
+    result[key] = resultForKey;
   }
   return result;
 }